# Risk Calculations

**P90, P50, P10**

Another approach to using multiple point estimation involves using probabilities which do not add up to 100%. We might for example, say that an arson attack on your office is 90% likely (Probability = 90% or ‘P90’) to be put out quickly by the state of the art fire suppression system with a loss of less than $100,000.

There might, hypothetically, be a 50% chance (P50) that the fire could cause $2million damage, but it would be very unlikely (P10) to cause a catastrophic loss with costs of $20 million. This would be expressed as “If there is an arson attack” the likely consequences are:

P90 - $100,000

P50 - $2,000,000

P10 - $20,000,000

This system isn’t designed to be mathematically accurate but is useful for discussing the likelihood of various consequences with stakeholders, to establish range estimates. It might also be expressed in terms of ‘almost certain’, ‘possible’, and ‘very unlikely’. You might for example, based on past years, consider your likely expected loss (EL) for annual theft as being:

P90 (almost certain) to lose $50,000 = 0.90 * $50,000 = $45,000 EL

P50 (credible scenario) a loss of $150,000 = 0.50 * $150,000 = $75,000 EL

P10 (worst case but unlikely) loss of $1,000,000 = 0.10 * $1,000,000 = $100,000 EL

With discussion, you might expand this to:

Plotted on a chart, you can see the range of expected likely outcomes. If there is a successful arson attack, the chance of a loss in excess of $200,000 is close to zero.